Re: Need to validate ftl before saving in DB

Hi Daniel,

Thanks for confirming, that the template should be non HTML-escaped.
Now I know what the root cause is. I will look into the reason why the
template gets HTML-escaped.

Thanks,
Rishabh

On Tue, Feb 16, 2010 at 1:51 PM, Daniel Dekany <[email protected]> wrote:

> Tuesday, February 16, 2010, 8:37:38 AM, Rishabh Joshi wrote:
>
> > Hi Daniel,
> >
> > Thanks for your response.
> > I doubled checked for the exception, by debugging through the code. And
> this is what I noticed:
> >
> > In my UI, I enter the following template
> > <#list ig as row>"${row.assessmentId}"</#list>
> >
> > which gets converted to:
> > &lt;#list ig as row&gt;&quot;${row.assessmentId}&quot;&lt;/#list&gt;
>
> Then there is the problem. What does the HTML-escaping? &lt;#list etc.
> is not and FTL directive for FreeMarker, just plain text that will be
> printed as-is.
>
> > before it reaches the code where I perform the validation. On
> > proceeding further, an exception is *not thrown*.
> > In the next iteration, I changed the incoming template string
> > within the debugger, before it reaches the validation code, to the
> original value -
> > <#list ig as row>"${row.assessmentId}"</#list>
> > and now, it did throw an exception as stated by you.
> >
> > Is this the expected behaviour of freemarker?
>
> No. The template shouldn't be HTML-escaped before it reaches the
> parser of FreeMarker.
>
> > Regards,
> > Rishabh
> >
> > 2010/2/16 Daniel Dekany <[email protected]>
> > Monday, February 15, 2010, 10:21:47 AM, rishabh9 wrote:
> >
> >>
> >> Hi,
> >>
> >> I use the below code to validate a ftl string I get from the UI, before
> >> saving in the DB. If an exception is thrown, I know there is a
> validation
> >> error and I report it accordingly to the UI.
> >>
> >> ================= BEGIN CODE ======================
> >>
> >> Configuration config = new Configuration();
> >> config.setStrictSyntaxMode(true);
> >> config.setTagSyntax(Configuration.AUTO_DETECT_TAG_SYNTAX);
> >>
> >> StringTemplateLoader stringLoader = new StringTemplateLoader();
> >> stringLoader.putTemplate(name, content);
> >> config.setTemplateLoader(stringLoader);
> >>
> >> try {
> >>     config.getTemplate(name);
> >> } catch (IOException e) {
> >>     LOG.error("The template's body is malformed.");
> >>     throw new CustomException("The template body is malformed.", e);
> >> }
> >>
> >> =================== END CODE =====================
> >>
> >> My problem is that, the above code seems to work partly. It does not
> >> validate the directives.
> >> For example, even if I miss out on closing a directive, the
> >> "config.getTemplate(name)" does not throw an exception -
> >>     <#list animals as being>
> >>         ${being.name}
> >
> > You mean, if the </#list> is missing, getTemplate doesn't throw
> > exception? Double-check that... it meant to throw exception in that
> > case:
> >
> >  freemarker.core.ParseException: Unexpected end of file reached.
> >  Unclosed list directive.
> >
> >> An exception is thrown, only when a variable, like - "${being.name}" is
> >> typed erroneously; something like - "${being"
> >>
> >> How can I validate the the directives?
> >
> > The *syntax* of directives (and of everything) is always checked by
> > getTemplate. In general, all Template objects correspond to a
> > syntactically correct template, since they store the template as
> > abstract syntax tree (not as text), so they are technically unable to
> > store syntactically wrong templates.
> >
> > Note that typos in variable *names* (including user-defined directive
> > names, the <@...> stuff) are not checked by getTemplate; they only
> > cause error when the template is evaluated (means: executed, generate
> > the output) with Template.process(...) or Environment.process(...).
> > Also, bad paths is #include/#import are not validated until the
> > template is evaluated, since unlike in C, those are runtime
> > instructions in FreeMarker.
> >
> >> Also, Is this the correct way to completely validate a template?
> >
> > Yes, that does the most comprehensive validation available, apart from
> > actually evaluating the template, as I pointed out earlier. Note that
> > the Template object returned by getTemplate will be cached and so it
> > will consume RAM even if you don't want to get it again in the
> > foreseeable future. If that's a problem, you can always purge the
> > cache:
> >
> >
> http://freemarker.org/docs/api/freemarker/template/Configuration.html#clearTemplateCache%28%29
> >
> >> I am using freemarker version 2.3.13
> >>
> >> Regards,
> >> Rishabh
> >
> > --
> > Best regards,
> >  Daniel Dekany
>
> --
> Best regards,
>  Daniel Dekany
>
>

------------------------------------------------------------------------------
SOLARIS 10 is the OS for Data Centers - provides features such as DTrace,
Predictive Self Healing and Award Winning ZFS. Get Solaris 10 NOW
http://p.sf.net/sfu/solaris-dev2dev

_______________________________________________
FreeMarker-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/freemarker-user